0

My /etc/rkhunter.conf.local contains this line:

PORT_WHITELIST='* TCP:7000'

If I run rkhunter -c it appears that the star is being shell expanded:

root@willow / # rkhunter -c
Invalid entry specified in PORT_WHITELIST configuration option: bin
Invalid entry specified in PORT_WHITELIST configuration option: boot
...

Does anyone know a way around this? I am using rkhunter 1.4.2-5 and Ubuntu 16.04.

David Tinker
  • 557
  • 1
  • 8
  • 16

1 Answers1

2

It looks like using the last rkhunter copies, you should update your conf from:

PORT_WHITELIST="/path/to/bin PROTO:PORT"

to:

PORT_PATH_WHITELIST="/path/to/bin"
PORT_WHITELIST="PROTO:PORT"

In your case:

PORT_PATH_WHITELIST="*" #or whatever bin binds to TCP:7000
PORT_WHITELIST="TCP:7000"
SYN
  • 1,751
  • 8
  • 14